There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-9142
A CVSS base score of 9.1 has been assigned.
Feedly found the first article mentioning CVE-2026-9142 . See article
CVE-2026-9142: Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present [CRITICAL] CVSS 9.1
CVE-2026-9142 - Exploits & Severity - Feedly
CVE-2026-9142 | NI grpc-device/InstrumentStudio up to 2.17.0 TLS Configuration missing authentication (GHSA-fhhw-37q8-6562)
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
